Loading story…
Tycoon, also tracked as RedRum, Grinch, and in some reporting alongside Thanos-linked variants, emerged as a manually deployed ransomware threat against enterprise environments on both Windows and Linux. Operators were reported to gain access through vulnerable or exposed RDP services, then encrypt files with AES-256-GCM while protecting encryption keys with RSA-1024. The malware appended extensions including .redrum, .grinch, .thanos, .eruption, and .magneto, and dropped a ransom note named decryption.txt using contact addresses such as moncler@tutamail.com and moncler@cock.li.
Reporting also tied the activity to broader Thanos ransomware development, a .NET-based RaaS ecosystem that enabled extensive customization, persistence, anti-analysis, and defense-evasion features across multiple later variants. The malware was described as deleting shadow copies and disabling recovery and firewall protections while avoiding some system files and directories to keep infected systems operational. Historical tracking indicates some early Hakbit-identified and RedRum samples could be decrypted, including with an Emsisoft decryptor, while later corrected Thanos-derived variants adopted stronger RSA-based encryption that generally prevented recovery without the attackers' private key.
TTPs, infrastructure, and targeting history in one profile.
6 events from the most recent confirmed update back to the earliest known activity.
RedRum ransomware activity is placed in early December 2019. The family targeted enterprise environments on Windows and Linux, using manually deployed payloads after access through exposed or vulnerable RDP servers.
A later Thanos variant using the .cyber extension was observed. It contacted victims via cyber@outlookpro.net, queried external IPs through icanhazip.com, disabled Task Manager via the registry, and downloaded PsExec from Sysinternals.
A .ravack variant was observed and described as a renamed copy of the earlier .abarcy variant. The campaign was distributed through a trojanized Movavi.Video.Editor.Plus.20.2.0.exe installer.
A variant self-identifying as Corona ransomware was observed and claimed to use RSA4096 and AES-256. It used the contact email recoba90@protonmail.com and a specified Bitcoin wallet for ransom payments.
A Hakbit/Thanos-linked variant using the .abarcy extension was observed, with victim contact via the Discord tag Abarcy#2996. The source presents it as part of the evolving Hakbit-to-Thanos lineage.
The Hakbit ransomware family was active by November 2019, with the source stating its activity peaked in early November. Early samples commonly used the .crypted extension and ransom notes tied to hakbit@protonmail.com.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 82 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
blogs.blackberry.com
Open sourceid-ransomware.blogspot.com
Open sourceid-ransomware.blogspot.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Prometheus emerged as a **Thanos-based ransomware** operation targeting organizations with file encryption, victim-specific extensions, and ransom notes such as `RESTORE_FILES_INFO.txt` and `.hta` variants, while also threatening to leak stolen data through a dedicated extortion site and negotiation portal. Researchers said the group claimed ties to **REvil**, but multiple analyses found no technical evidence to support that assertion, instead linking Prometheus to the leaked Thanos builder and a broader ransomware-as-a-service ecosystem. Reported demands ranged from **$6,000 to $100,000 in Monero**, and the malware was observed terminating backup and security processes, altering services, and disabling protections including **Raccine** to speed encryption and increase pressure on victims. A free **CyCraft decryptor** later offered partial recovery for some Prometheus-encrypted files by brute-forcing the malware's weak tickcount-derived **Salsa20** key generation, a flaw that made decryption feasible when known file structures or magic bytes were available. Its release was followed by the apparent shutdown of Prometheus infrastructure, but closely related **Thanos-derived** strains including **Haron, Spook, and Midas** continued to appear, reusing code, extortion tactics, leak sites, and technical markers such as shared note formats and encryption artifacts. Subsequent reporting tied these families to rebranding and builder reuse rather than a single clear attribution, showing how Prometheus became part of a wider lineage of ransomware operations targeting businesses across multiple sectors and countries.
Aug 15, 2026
Ransomware operators have been observed using **bring-your-own-vulnerable-driver (BYOVD)** techniques and custom anti-security tools to shut down endpoint protections before encrypting enterprise networks. Kaspersky documented a MedusaLocker intrusion in Brazil in which attackers accessed an SMTP server over RDP with valid administrative credentials, used **Mimikatz** to extract NTLM hashes, and moved laterally with pass-the-hash via PowerShell-based WMI and SMB execution before deploying a new AV-killer tool, `All.exe`. That tool loaded a renamed **TechPowerUp `ThrottleStop.sys`** driver (`ThrottleBlood.sys`), exploited vulnerable IOCTLs for physical memory read/write, hijacked kernel execution through `NtAddAtom`, and repeatedly terminated products from Microsoft Defender, CrowdStrike, SentinelOne, Sophos, Symantec, Bitdefender, ESET, Avast, AVG, McAfee, Panda, Quick Heal, and Kaspersky; the driver issue was assigned **`CVE-2025-7771`**. A separate report on **The Gentlemen** ransomware described a similar pattern in enterprise attacks across the Asia-Pacific region, where the group likely gained entry through an exposed FortiGate device or stolen credentials, then conducted Active Directory reconnaissance, used **PsExec** for lateral movement, established persistence with **AnyDesk**, abused **GPO** and **NETLOGON** for domain-wide deployment, and exfiltrated data with **WinSCP** for double extortion. TrendAI said the group evolved from generic anti-AV tooling to customized variants tailored to the security products installed in each victim environment, while also disabling Windows Defender and recovery mechanisms before dropping `README-GENTLEMEN.txt` and encrypting files with the `.7mtzhh` extension. Together, the incidents show ransomware crews increasingly pairing credential abuse and lateral movement with vulnerable-driver abuse and bespoke defense evasion to maximize encryption success.
Aug 21, 2026
**Rhino ransomware**, also tracked as **Marvel**, was identified as a business-targeting crypto-ransomware family that encrypted files using **AES+RSA** and demanded **Bitcoin** for decryption. Reporting says the malware emerged in early 2020, primarily hit English-speaking victims, and appended extensions such as `.[generalchin@countermail.com].rhino` to locked files. Its ransom notes were delivered through files including `info.hta`, `Decryptor_Info.hta`, and `ReadMe_Decryptor.txt`, while a sample later analyzed by VMRay had reportedly been found by security researcher **@GrujaRS**. Technical reporting links Rhino/Marvel to the broader **DCRTR** ransomware lineage and says the family evolved into multiple later variants and aliases, including **Parrot**, **Coka**, and **Termit**, each using different extensions and contact addresses. Analysts documented behavior consistent with enterprise-focused ransomware, including stopping security and server-related services, deleting shadow copies, disabling recovery features, establishing persistence through **Run** registry keys, and using mutexes such as `Marvel` and `Marvel01`.
Aug 14, 2026